News for hackers. Stuff that matters.

A comment on Let’s Talk about PAKE (2018).

Re:Let’s Talk about PAKE (2018) by bullen on Friday October 22, 2021 @02:33AM (#28954261)
What is the benefit of PAKE over this: https://datatracker.ietf.org/doc/html/rfc2289
[ Parent | on HN ]
Re:Let’s Talk about PAKE (2018) by sc00bz on Wednesday October 27, 2021 @11:20PM (#29022000)
PAKEs are secure over insecure channels. Also I'm pretty sure for RFC2289 the server stores a password equivalent. If you neither care about creating an encrypted session nor being secure over an insecure channel, then you should use SCRAM. With SCRAM, the server stores a password hash equivalent. Meaning an attacker needs to crack the password before they can login as them.
[ Parent | on HN ]